CrowdSec IPS Career Development IT — พัฒนาอาชีพ

CrowdSec IPS + Security Career

CrowdSec IPS Intrusion Prevention Crowd Intelligence Bouncer Scenarios SOC Analyst Security Engineer Career Cybersecurity

Component	Function	Example	Config
Agent	อ่าน Log วิเคราะห์ Attack	crowdsec service	/etc/crowdsec/
Bouncer	บล็อก IP ที่เป็นอันตราย	cs-firewall-bouncer	/etc/crowdsec/bouncers/
Scenarios	กฎตรวจจับ Attack Pattern	ssh-bf, http-crawl	/etc/crowdsec/scenarios/
Parsers	Parse Log Format	nginx-logs, sshd-logs	/etc/crowdsec/parsers/
Console	Dashboard Alert Statistics	app.crowdsec.net	cscli console enroll
Hub	Repository Scenarios Parsers	hub.crowdsec.net	cscli hub update

Installation & Setup

# === CrowdSec Installation ===

# Install CrowdSec Agent (Debian/Ubuntu)
# curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
# sudo apt install crowdsec
#
# Install Firewall Bouncer
# sudo apt install crowdsec-firewall-bouncer-iptables
#
# Or Nginx Bouncer
# sudo apt install crowdsec-nginx-bouncer
#
# Add data sources
# sudo vi /etc/crowdsec/acquis.yaml
# ---
# filenames:
#   - /var/log/nginx/access.log
#   - /var/log/nginx/error.log
# labels:
#   type: nginx
# ---
# filenames:
#   - /var/log/auth.log
# labels:
#   type: syslog
#
# Install scenarios from Hub
# sudo cscli scenarios install crowdsecurity/ssh-bf
# sudo cscli scenarios install crowdsecurity/http-crawl-non_statics
# sudo cscli scenarios install crowdsecurity/http-bad-user-agent
# sudo cscli scenarios install crowdsecurity/http-path-traversal-probing
#
# Restart
# sudo systemctl restart crowdsec
#
# Check status
# sudo cscli metrics
# sudo cscli decisions list
# sudo cscli alerts list

from dataclasses import dataclass

@dataclass
class SetupStep:
    step: int
    action: str
    command: str
    verify: str
    note: str

steps = [
    SetupStep(1, "Install Agent",
        "apt install crowdsec",
        "systemctl status crowdsec",
        "Agent อ่าน Log วิเคราะห์ Attack"),
    SetupStep(2, "Install Bouncer",
        "apt install crowdsec-firewall-bouncer-iptables",
        "cscli bouncers list",
        "Bouncer บล็อก IP ผ่าน iptables"),
    SetupStep(3, "Configure Data Sources",
        "vi /etc/crowdsec/acquis.yaml",
        "cscli metrics | grep acquired",
        "ชี้ไปที่ Log File ที่ต้องการ Monitor"),
    SetupStep(4, "Install Scenarios",
        "cscli scenarios install crowdsecurity/ssh-bf",
        "cscli scenarios list",
        "ติดตั้ง Scenarios จาก Hub ตามที่ต้องการ"),
    SetupStep(5, "Enroll Console",
        "cscli console enroll YOUR_KEY",
        "ดู app.crowdsec.net",
        "ดู Dashboard Alert Statistics Online"),
    SetupStep(6, "Setup Notification",
        "vi /etc/crowdsec/notifications/slack.yaml",
        "cscli notifications list",
        "ส่ง Alert ไป Slack Email Telegram"),
]

print("=== Setup Steps ===")
for s in steps:
    print(f"  Step {s.step}: {s.action}")
    print(f"    Command: {s.command}")
    print(f"    Verify: {s.verify}")
    print(f"    Note: {s.note}")

Security Career Path

# === Career Path ===

@dataclass
class CareerLevel:
    level: str
    role: str
    experience: str
    salary: str
    skills: str
    certifications: str

careers = [
    CareerLevel("Entry",
        "SOC Analyst L1 / IT Security Associate",
        "0-2 ปี", "30,000-50,000 บาท",
        "SIEM Alert Triage, Firewall Rules, IPS/IDS, Log Analysis",
        "CompTIA Security+, CrowdSec Certified, CEH"),
    CareerLevel("Mid",
        "SOC Analyst L2 / Security Engineer",
        "2-5 ปี", "50,000-100,000 บาท",
        "Incident Response, Threat Hunting, SIEM Advanced, IPS Config",
        "CEH, CySA+, GCIH, OSCP (เริ่มเรียน)"),
    CareerLevel("Senior",
        "Senior Security Engineer / Penetration Tester",
        "5-8 ปี", "80,000-150,000 บาท",
        "Architecture Review, Red Team, Automation, DevSecOps",
        "OSCP, GPEN, CISSP (เริ่มเรียน)"),
    CareerLevel("Lead",
        "Security Architect / Security Manager",
        "8-12 ปี", "120,000-200,000 บาท",
        "Security Architecture, Risk Management, Team Lead, Strategy",
        "CISSP, CISM, TOGAF Security"),
    CareerLevel("Executive",
        "CISO / VP of Security",
        "12+ ปี", "200,000-400,000+ บาท",
        "Business Strategy, Risk Governance, Board Communication",
        "CISSP, CISM, MBA (optional)"),
]

print("=== Security Career Path ===")
for c in careers:
    print(f"  [{c.level}] {c.role} ({c.experience})")
    print(f"    Salary: {c.salary}")
    print(f"    Skills: {c.skills}")
    print(f"    Certs: {c.certifications}")

Monitoring & Alert

# === Monitoring Setup ===

# CrowdSec Metrics
# sudo cscli metrics
# sudo cscli decisions list
# sudo cscli alerts list --since 24h
#
# Prometheus metrics endpoint
# /etc/crowdsec/config.yaml
# prometheus:
#   enabled: true
#   level: full
#   listen_addr: 127.0.0.1
#   listen_port: 6060
#
# Grafana Dashboard for CrowdSec
# Import dashboard ID: 14541

@dataclass
class MonitorMetric:
    metric: str
    command: str
    threshold: str
    action: str

metrics = [
    MonitorMetric("Blocked IPs (Decisions)",
        "cscli decisions list | wc -l",
        "ดู Trend ไม่ควรเพิ่มขึ้นผิดปกติ",
        "ถ้าเพิ่มมาก ตรวจว่าถูกโจมตีหรือ False Positive"),
    MonitorMetric("Alerts per Hour",
        "cscli alerts list --since 1h",
        "> 100 alerts/hr = ผิดปกติ",
        "ตรวจ Source IP Pattern ว่าเป็น Attack จริง"),
    MonitorMetric("Parser Errors",
        "cscli metrics | grep unparsed",
        "0 unparsed lines",
        "ถ้ามี Unparsed ตรวจ Parser Config ให้ถูกต้อง"),
    MonitorMetric("Bouncer Status",
        "cscli bouncers list",
        "ทุก Bouncer ต้อง Active",
        "Restart Bouncer ถ้า Inactive"),
    MonitorMetric("Community Blocklist",
        "cscli console status",
        "Connected + Syncing",
        "ตรวจ Network ถ้า Disconnected"),
]

print("=== Monitoring ===")
for m in metrics:
    print(f"  [{m.metric}] Command: {m.command}")
    print(f"    Threshold: {m.threshold}")
    print(f"    Action: {m.action}")

เคล็ดลับ

• Hub: ติดตั้ง Scenarios จาก Hub ก่อน อย่าเขียนเอง ถ้ามีสำเร็จรูป
• Bouncer: ใช้ Firewall Bouncer สำหรับ Block ระดับ IP ดีที่สุด
• Console: ลงทะเบียน Console ดู Dashboard สถิติ Community Blocklist
• Whitelist: Whitelist IP ที่เชื่อถือได้ เช่น Office IP Monitoring
• Career: เริ่มจาก CompTIA Security+ แล้วเรียน CEH OSCP ตามลำดับ

CrowdSec คืออะไร

Open Source IPS Crowd Intelligence Log Analysis Brute Force DDoS Bouncer Block IP Scenarios Community Blacklist Console Dashboard Free